Secret-dependent timing paths reported and remediated through disclosure.
Cryptographic code · side-channel review
Constant-time analysis for cryptographic implementation paths
A specialist track within a critical implementation review for teams concerned about secret-dependent control flow, arithmetic, or observable timing behavior.
When this is useful
- Secret material reaches arithmetic, reduction, parsing, rejection, or key-generation paths whose timing properties are unclear.
- A constant-time claim needs independent scrutiny across source, compiler output, target architecture, or runtime behavior.
- Multiple implementations are expected to be functionally equivalent but may differ in timing or memory-access behavior.
- A suspected side channel needs a reproducible path, impact analysis, and coordinated remediation.
How the work proceeds
- 01
Map secrets to observables
Identify secret-bearing inputs, sensitive operations, target platforms, attacker observations, and the exact constant-time claim under review.
- 02
Trace high-risk paths
Review control flow, arithmetic, compiler effects, and implementation choices that can make behavior depend on secret data.
- 03
Construct independent checks
Use source analysis, targeted experiments, and differential or constant-time checks appropriate to the stated threat model.
- 04
Report and retest
Provide reproducible evidence, coordinate sensitive disclosure where needed, and verify the relevant remediation paths.
Public evidence
Start with work you can inspect
The linked advisory and upstream change evidence.
Functional and constant-time oracle design across independent libraries.
Next step
Describe the decision, not secrets
A short, non-confidential note about the system, milestone, desired evidence, timing, and possible Ethereum Foundation conflicts is enough to begin. Do not email vulnerability details, source code, credentials, or secrets.
Independent engagements are limited, subject to conflict review, and represent my own views and work. They are not offered, endorsed, or reviewed by the Ethereum Foundation.